Ethereum Developers Flag Auction Risk in Glamsterdam Test

Ethereum developers confirmed the October 6 date for the public Glamsterdam test on Sepolia. They issued a warning that disposable builder identities can exploit free test ether to disrupt block production. The attack vector involves winning auctions and refusing to reveal transaction payloads.

The threat does not endanger mainnet funds. It targets the test network where currency has no real-world cost. The disruption could halt infrastructure testing required before the upgrade reaches the main chain.

Vulnerability in free test networks

Glamsterdam moves block builder competition into the Ethereum protocol. Builders assemble transactions and bid to supply them to validators. On Sepolia, malicious operators can submit high bids to outcompete legitimate builders. They can then withhold the promised transaction data.

Potuz, an Ethereum consensus developer, stated that an attacker can rotate thousands of builder identities. This allows them to win auctions repeatedly without penalty. The current safeguards only fall back to local blocks after multiple missing payloads.

Shortened review window for clients

Client teams must release Sepolia-ready software by September 29. This leaves seven days before the fork. The standard Ethereum upgrade process reserves 14 days for security reviews and bug-bounty testing. Developers accepted the shorter window because Sepolia is easier to recover if failures occur.

Production builder software from Titan and Ultrasound has not completed the transition. This gap remains before the upgrade is considered mainnet-ready. A large private rehearsal completed the transition and raised the block gas limit toward 200 million without losing finality.

Capacity expansion and next steps

The upgrade aims to fit more activity into each block. It supports a block gas limit of approximately 200 million. This creates room for more payments and trades before fee bidding increases. The next public test on Hoodi is tentatively planned for October 27.

Developers will review Sepolia results before confirming the Hoodi date. Mainnet activation remains unscheduled. CoinDesk reported that developers are focused on identifying and rejecting malicious builders to prevent repeated attacks under new identities.